{"action":"created","comment":{"url":"https://api.github.com/repos/vmware/vic/pulls/comments/126777003","pull_request_review_id":49294329,"id":126777003,"diff_hunk":"@@ -26,21 +26,50 @@ import (\n \t\"github.com/vmware/vic/pkg/ip\"\n )\n \n+type TrustLevel int\n+\n+const (\n+\tPublished TrustLevel = iota\n+\tOpen\n+\tClosed\n+\tOutbound\n+\tPeers\n+)\n+\n+func (t TrustLevel) String() string {\n+\tswitch t {\n+\tcase Open:\n+\t\treturn \"open\"\n+\tcase Closed:\n+\t\treturn \"closed\"\n+\tcase Published:\n+\t\treturn \"published\"\n+\tcase Outbound:\n+\t\treturn \"outbound\"\n+\tcase Peers:\n+\t\treturn \"peers\"\n+\t}\n+\tlog.Warningf(\"Unknown trust level %d. Defaulting to Published.\", int(t))\n+\treturn \"published\"\n+}\n+\n // CNetworks holds user input from container network flags\n type CNetworks struct {\n \tContainerNetworks         cli.StringSlice `arg:\"container-network\"`\n \tContainerNetworksGateway  cli.StringSlice `arg:\"container-network-gateway\"`\n \tContainerNetworksIPRanges cli.StringSlice `arg:\"container-network-ip-range\"`\n \tContainerNetworksDNS      cli.StringSlice `arg:\"container-network-dns\"`\n+\tContainerNetworksFirewall cli.StringSlice `arg:\"container-network-firewall\"`\n \tIsSet                     bool\n }\n \n // ContainerNetworks holds container network data after processing\n type ContainerNetworks struct {\n-\tMappedNetworks         map[string]string     `cmd:\"parent\" label:\"key-value\"`\n-\tMappedNetworksGateways map[string]net.IPNet  `cmd:\"gateway\" label:\"key-value\"`\n-\tMappedNetworksIPRanges map[string][]ip.Range `cmd:\"ip-range\" label:\"key-value\"`\n-\tMappedNetworksDNS      map[string][]net.IP   `cmd:\"dns\" label:\"key-value\"`\n+\tMappedNetworks          map[string]string     `cmd:\"parent\" label:\"key-value\"`\n+\tMappedNetworksGateways  map[string]net.IPNet  `cmd:\"gateway\" label:\"key-value\"`\n+\tMappedNetworksIPRanges  map[string][]ip.Range `cmd:\"ip-range\" label:\"key-value\"`\n+\tMappedNetworksDNS       map[string][]net.IP   `cmd:\"dns\" label:\"key-value\"`\n+\tMappedNetworksFirewalls map[string]TrustLevel `cmd:\"firewall\" label:\"key-value\"`\n }\n \n func (c *ContainerNetworks) IsSet() bool {","path":"cmd/vic-machine/common/cnetworks.go","position":54,"original_position":54,"commit_id":"0960fb3d9366d5af7bc0ceb5e79a23dea4be1f9c","original_commit_id":"0960fb3d9366d5af7bc0ceb5e79a23dea4be1f9c","user":{"login":"emlin","id":1091772,"avatar_url":"https://avatars3.githubusercontent.com/u/1091772?v=3","gravatar_id":"","url":"https://api.github.com/users/emlin","html_url":"https://github.com/emlin","followers_url":"https://api.github.com/users/emlin/followers","following_url":"https://api.github.com/users/emlin/following{/other_user}","gists_url":"https://api.github.com/users/emlin/gists{/gist_id}","starred_url":"https://api.github.com/users/emlin/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/emlin/subscriptions","organizations_url":"https://api.github.com/users/emlin/orgs","repos_url":"https://api.github.com/users/emlin/repos","events_url":"https://api.github.com/users/emlin/events{/privacy}","received_events_url":"https://api.github.com/users/emlin/received_events","type":"User","site_admin":false},"body":"this flag is to test if there is any container network options set. Should be changed to include container network firewall configuration as well","created_at":"2017-07-11T18:51:37Z","updated_at":"2017-07-11T18:51:37Z","html_url":"https://github.com/vmware/vic/pull/5641#discussion_r126777003","pull_request_url":"https://api.github.com/repos/vmware/vic/pulls/5641","_links":{"self":{"href":"https://api.github.com/repos/vmware/vic/pulls/comments/126777003"},"html":{"href":"https://github.com/vmware/vic/pull/5641#discussion_r126777003"},"pull_request":{"href":"https://api.github.com/repos/vmware/vic/pulls/5641"}}},"pull_request":{"url":"https://api.github.com/repos/vmware/vic/pulls/5641","id":129011581,"html_url":"https://github.com/vmware/vic/pull/5641","diff_url":"https://github.com/vmware/vic/pull/5641.diff","patch_url":"https://github.com/vmware/vic/pull/5641.patch","issue_url":"https://api.github.com/repos/vmware/vic/issues/5641","number":5641,"state":"open","locked":false,"title":"[specific ci=Group6-VIC-Machine] Configure level of trust for container-network (#5426)","user":{"login":"willsherwood","id":5732790,"avatar_url":"https://avatars1.githubusercontent.com/u/5732790?v=3","gravatar_id":"","url":"https://api.github.com/users/willsherwood","html_url":"https://github.com/willsherwood","followers_url":"https://api.github.com/users/willsherwood/followers","following_url":"https://api.github.com/users/willsherwood/following{/other_user}","gists_url":"https://api.github.com/users/willsherwood/gists{/gist_id}","starred_url":"https://api.github.com/users/willsherwood/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/willsherwood/subscriptions","organizations_url":"https://api.github.com/users/willsherwood/orgs","repos_url":"https://api.github.com/users/willsherwood/repos","events_url":"https://api.github.com/users/willsherwood/events{/privacy}","received_events_url":"https://api.github.com/users/willsherwood/received_events","type":"User","site_admin":false},"body":"Implements #5426 .\r\n\r\nDetails:\r\n\r\n- Adds a new flag `--container-network-firewall`/`-cnf` to vic-machine's create and configure.\r\n    - open: All ports on containers connected to this network are open.\r\n    - closed: All ports on containers connected to this network are closed.\r\n    - outbound: All incoming traffic is dropped, but all outbound traffic is allowed.\r\n    - peers: Same as outbound, except all ports are open to the ip address range configured by --container-network-ip-range.\r\n    - published: Same as outbound, except ports published with the `-p` flag are allowed for \r\ninbound.\r\n- vic-machine configure on container networks already set up fails with message \"vic-machine configure failed: changes to existing container networks are not supported\".\r\n    - This is in line with all other container network operations.\r\n    - Configuring new container networks is allowed (see Ex2).\r\n- This does not handle container network isolation. (see Ex3).\r\n\r\nEx1 (Create)\r\nCreate a container network `'out'` that rejects incoming traffic, but can establish connections with other hosts and communicate bidirectionally between them:\r\n```\r\nvic-machine create -cn out -cnf out:outbound\r\ndocker -H $DOCKER_HOST run -it --network out busybox\r\n    $ ping 8.8.8.8\r\n    >>> PING 8.8.8.8 (8.8.8.8) 56(84) bytes of data.\r\n        64 bytes from 8.8.8.8: icmp_seq=1 ttl=128 time=11.0ms\r\n    $ nc -l -p 123 # open a server on port 123\r\n    >>> No machine can connect to this endpoint.\r\n``` \r\n\r\nEx2 (Reconfigure)\r\nCorrectly reconfiguring a VCH to add a new container network with published firewall:\r\n```\r\nvic-machine create -cn mynetwork -cnf mynetwork:closed\r\nvic-machine configure -cn anewnetwork -cnf anewnetwork:published\r\n>>> a new container network is created and its firewall configured.\r\n```\r\nIncorrectly reconfiguring a VCH to modify an existing container network:\r\n```\r\nvic-machine create -cn mynetwork -cnf mynetwork:closed\r\nvic-machine configure -cn mynetwork -cnf mynetwork:published\r\n>>> vic-machine configure failed: changes to existing container networks are not supported\r\n```\r\n\r\nEx3 (Network Isolation)\r\n_Vic_: Two distinct external networks can communicate over open ports. (This is up to vSphere)\r\n```vic-machine create --container-network a --container-network b\r\ndocker -H $DOCKER_HOST run -it --network a -p 777 busybox\r\n    $ nc -l -p 777 // Open a server listening on port 777\r\ndocker -H $DOCKER_HOST run -it --network b busybox\r\n    $ nc $Aipaddress\r\n    >>> connects successfully and can relay messages from both\r\n```\r\n_Vanilla Docker_: Two distinct external networks cannot communicate over open ports.\r\n```\r\ndocker run --network a -p 777 busybox\r\n    >>> nc -l -p 777\r\ndocker run --network b busybox\r\n    >>> nc $aipaddress\r\n    No connection\r\n```","created_at":"2017-07-05T17:06:37Z","updated_at":"2017-07-11T18:51:37Z","closed_at":null,"merged_at":null,"merge_commit_sha":"d00e683e532bfc3182f76f08daf6db979fa7094b","assignee":null,"assignees":[],"requested_reviewers":[],"milestone":null,"commits_url":"https://api.github.com/repos/vmware/vic/pulls/5641/commits","review_comments_url":"https://api.github.com/repos/vmware/vic/pulls/5641/comments","review_comment_url":"https://api.github.com/repos/vmware/vic/pulls/comments{/number}","comments_url":"https://api.github.com/repos/vmware/vic/issues/5641/comments","statuses_url":"https://api.github.com/repos/vmware/vic/statuses/0960fb3d9366d5af7bc0ceb5e79a23dea4be1f9c","head":{"label":"willsherwood:5426","ref":"5426","sha":"0960fb3d9366d5af7bc0ceb5e79a23dea4be1f9c","user":{"login":"willsherwood","id":5732790,"avatar_url":"https://avatars1.githubusercontent.com/u/5732790?v=3","gravatar_id":"","url":"https://api.github.com/users/willsherwood","html_url":"https://github.com/willsherwood","followers_url":"https://api.github.com/users/willsherwood/followers","following_url":"https://api.github.com/users/willsherwood/following{/other_user}","gists_url":"https://api.github.com/users/willsherwood/gists{/gist_id}","starred_url":"https://api.github.com/users/willsherwood/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/willsherwood/subscriptions","organizations_url":"https://api.github.com/users/willsherwood/orgs","repos_url":"https://api.github.com/users/willsherwood/repos","events_url":"https://api.github.com/users/willsherwood/events{/privacy}","received_events_url":"https://api.github.com/users/willsherwood/received_events","type":"User","site_admin":false},"repo":{"id":92983098,"name":"vic","full_name":"willsherwood/vic","owner":{"login":"willsherwood","id":5732790,"avatar_url":"https://avatars1.githubusercontent.com/u/5732790?v=3","gravatar_id":"","url":"https://api.github.com/users/willsherwood","html_url":"https://github.com/willsherwood","followers_url":"https://api.github.com/users/willsherwood/followers","following_url":"https://api.github.com/users/willsherwood/following{/other_user}","gists_url":"https://api.github.com/users/willsherwood/gists{/gist_id}","starred_url":"https://api.github.com/users/willsherwood/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/willsherwood/subscriptions","organizations_url":"https://api.github.com/users/willsherwood/orgs","repos_url":"https://api.github.com/users/willsherwood/repos","events_url":"https://api.github.com/users/willsherwood/events{/privacy}","received_events_url":"https://api.github.com/users/willsherwood/received_events","type":"User","site_admin":false},"private":false,"html_url":"https://github.com/willsherwood/vic","description":"Integrated containers engine on vSphere","fork":true,"url":"https://api.github.com/repos/willsherwood/vic","forks_url":"https://api.github.com/repos/willsherwood/vic/forks","keys_url":"https://api.github.com/repos/willsherwood/vic/keys{/key_id}","collaborators_url":"https://api.github.com/repos/willsherwood/vic/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/willsherwood/vic/teams","hooks_url":"https://api.github.com/repos/willsherwood/vic/hooks","issue_events_url":"https://api.github.com/repos/willsherwood/vic/issues/events{/number}","events_url":"https://api.github.com/repos/willsherwood/vic/events","assignees_url":"https://api.github.com/repos/willsherwood/vic/assignees{/user}","branches_url":"https://api.github.com/repos/willsherwood/vic/branches{/branch}","tags_url":"https://api.github.com/repos/willsherwood/vic/tags","blobs_url":"https://api.github.com/repos/willsherwood/vic/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/willsherwood/vic/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/willsherwood/vic/git/refs{/sha}","trees_url":"https://api.github.com/repos/willsherwood/vic/git/trees{/sha}","statuses_url":"https://api.github.com/repos/willsherwood/vic/statuses/{sha}","languages_url":"https://api.github.com/repos/willsherwood/vic/languages","stargazers_url":"https://api.github.com/repos/willsherwood/vic/stargazers","contributors_url":"https://api.github.com/repos/willsherwood/vic/contributors","subscribers_url":"https://api.github.com/repos/willsherwood/vic/subscribers","subscription_url":"https://api.github.com/repos/willsherwood/vic/subscription","commits_url":"https://api.github.com/repos/willsherwood/vic/commits{/sha}","git_commits_url":"https://api.github.com/repos/willsherwood/vic/git/commits{/sha}","comments_url":"https://api.github.com/repos/willsherwood/vic/comments{/number}","issue_comment_url":"https://api.github.com/repos/willsherwood/vic/issues/comments{/number}","contents_url":"https://api.github.com/repos/willsherwood/vic/contents/{+path}","compare_url":"https://api.github.com/repos/willsherwood/vic/compare/{base}...{head}","merges_url":"https://api.github.com/repos/willsherwood/vic/merges","archive_url":"https://api.github.com/repos/willsherwood/vic/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/willsherwood/vic/downloads","issues_url":"https://api.github.com/repos/willsherwood/vic/issues{/number}","pulls_url":"https://api.github.com/repos/willsherwood/vic/pulls{/number}","milestones_url":"https://api.github.com/repos/willsherwood/vic/milestones{/number}","notifications_url":"https://api.github.com/repos/willsherwood/vic/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/willsherwood/vic/labels{/name}","releases_url":"https://api.github.com/repos/willsherwood/vic/releases{/id}","deployments_url":"https://api.github.com/repos/willsherwood/vic/deployments","created_at":"2017-05-31T19:51:08Z","updated_at":"2017-05-31T19:51:12Z","pushed_at":"2017-07-11T18:02:35Z","git_url":"git://github.com/willsherwood/vic.git","ssh_url":"git@github.com:willsherwood/vic.git","clone_url":"https://github.com/willsherwood/vic.git","svn_url":"https://github.com/willsherwood/vic","homepage":"http://vmware.github.io/vic","size":65855,"stargazers_count":0,"watchers_count":0,"language":"Go","has_issues":false,"has_projects":true,"has_downloads":true,"has_wiki":true,"has_pages":false,"forks_count":0,"mirror_url":null,"open_issues_count":0,"forks":0,"open_issues":0,"watchers":0,"default_branch":"master"}},"base":{"label":"vmware:master","ref":"master","sha":"addc8b11817ac008a83d6efab92618bb7fd04b4a","user":{"login":"vmware","id":473334,"avatar_url":"https://avatars3.githubusercontent.com/u/473334?v=3","gravatar_id":"","url":"https://api.github.com/users/vmware","html_url":"https://github.com/vmware","followers_url":"https://api.github.com/users/vmware/followers","following_url":"https://api.github.com/users/vmware/following{/other_user}","gists_url":"https://api.github.com/users/vmware/gists{/gist_id}","starred_url":"https://api.github.com/users/vmware/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/vmware/subscriptions","organizations_url":"https://api.github.com/users/vmware/orgs","repos_url":"https://api.github.com/users/vmware/repos","events_url":"https://api.github.com/users/vmware/events{/privacy}","received_events_url":"https://api.github.com/users/vmware/received_events","type":"Organization","site_admin":false},"repo":{"id":49597898,"name":"vic","full_name":"vmware/vic","owner":{"login":"vmware","id":473334,"avatar_url":"https://avatars3.githubusercontent.com/u/473334?v=3","gravatar_id":"","url":"https://api.github.com/users/vmware","html_url":"https://github.com/vmware","followers_url":"https://api.github.com/users/vmware/followers","following_url":"https://api.github.com/users/vmware/following{/other_user}","gists_url":"https://api.github.com/users/vmware/gists{/gist_id}","starred_url":"https://api.github.com/users/vmware/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/vmware/subscriptions","organizations_url":"https://api.github.com/users/vmware/orgs","repos_url":"https://api.github.com/users/vmware/repos","events_url":"https://api.github.com/users/vmware/events{/privacy}","received_events_url":"https://api.github.com/users/vmware/received_events","type":"Organization","site_admin":false},"private":false,"html_url":"https://github.com/vmware/vic","description":"Integrated containers engine on vSphere","fork":false,"url":"https://api.github.com/repos/vmware/vic","forks_url":"https://api.github.com/repos/vmware/vic/forks","keys_url":"https://api.github.com/repos/vmware/vic/keys{/key_id}","collaborators_url":"https://api.github.com/repos/vmware/vic/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/vmware/vic/teams","hooks_url":"https://api.github.com/repos/vmware/vic/hooks","issue_events_url":"https://api.github.com/repos/vmware/vic/issues/events{/number}","events_url":"https://api.github.com/repos/vmware/vic/events","assignees_url":"https://api.github.com/repos/vmware/vic/assignees{/user}","branches_url":"https://api.github.com/repos/vmware/vic/branches{/branch}","tags_url":"https://api.github.com/repos/vmware/vic/tags","blobs_url":"https://api.github.com/repos/vmware/vic/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/vmware/vic/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/vmware/vic/git/refs{/sha}","trees_url":"https://api.github.com/repos/vmware/vic/git/trees{/sha}","statuses_url":"https://api.github.com/repos/vmware/vic/statuses/{sha}","languages_url":"https://api.github.com/repos/vmware/vic/languages","stargazers_url":"https://api.github.com/repos/vmware/vic/stargazers","contributors_url":"https://api.github.com/repos/vmware/vic/contributors","subscribers_url":"https://api.github.com/repos/vmware/vic/subscribers","subscription_url":"https://api.github.com/repos/vmware/vic/subscription","commits_url":"https://api.github.com/repos/vmware/vic/commits{/sha}","git_commits_url":"https://api.github.com/repos/vmware/vic/git/commits{/sha}","comments_url":"https://api.github.com/repos/vmware/vic/comments{/number}","issue_comment_url":"https://api.github.com/repos/vmware/vic/issues/comments{/number}","contents_url":"https://api.github.com/repos/vmware/vic/contents/{+path}","compare_url":"https://api.github.com/repos/vmware/vic/compare/{base}...{head}","merges_url":"https://api.github.com/repos/vmware/vic/merges","archive_url":"https://api.github.com/repos/vmware/vic/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/vmware/vic/downloads","issues_url":"https://api.github.com/repos/vmware/vic/issues{/number}","pulls_url":"https://api.github.com/repos/vmware/vic/pulls{/number}","milestones_url":"https://api.github.com/repos/vmware/vic/milestones{/number}","notifications_url":"https://api.github.com/repos/vmware/vic/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/vmware/vic/labels{/name}","releases_url":"https://api.github.com/repos/vmware/vic/releases{/id}","deployments_url":"https://api.github.com/repos/vmware/vic/deployments","created_at":"2016-01-13T19:53:57Z","updated_at":"2017-07-08T07:23:05Z","pushed_at":"2017-07-11T18:47:07Z","git_url":"git://github.com/vmware/vic.git","ssh_url":"git@github.com:vmware/vic.git","clone_url":"https://github.com/vmware/vic.git","svn_url":"https://github.com/vmware/vic","homepage":"http://vmware.github.io/vic","size":66601,"stargazers_count":254,"watchers_count":254,"language":"Go","has_issues":true,"has_projects":true,"has_downloads":true,"has_wiki":true,"has_pages":true,"forks_count":105,"mirror_url":null,"open_issues_count":855,"forks":105,"open_issues":855,"watchers":254,"default_branch":"master"}},"_links":{"self":{"href":"https://api.github.com/repos/vmware/vic/pulls/5641"},"html":{"href":"https://github.com/vmware/vic/pull/5641"},"issue":{"href":"https://api.github.com/repos/vmware/vic/issues/5641"},"comments":{"href":"https://api.github.com/repos/vmware/vic/issues/5641/comments"},"review_comments":{"href":"https://api.github.com/repos/vmware/vic/pulls/5641/comments"},"review_comment":{"href":"https://api.github.com/repos/vmware/vic/pulls/comments{/number}"},"commits":{"href":"https://api.github.com/repos/vmware/vic/pulls/5641/commits"},"statuses":{"href":"https://api.github.com/repos/vmware/vic/statuses/0960fb3d9366d5af7bc0ceb5e79a23dea4be1f9c"}}}}
{"actor":{"display_login":"emlin"}}